[Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Heiko Thiery]

In CycloneDX the serialNumber field is an optional top-level field that
uniquely identified a SBOM using a URN RFC 4122 UUID format.

Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
---
 utils/generate-cyclonedx | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
index df12ee84c0..c3b614b6be 100755
--- a/utils/generate-cyclonedx
+++ b/utils/generate-cyclonedx
@@ -19,6 +19,7 @@ import urllib.request
 import subprocess
 import sys
 import re
+import uuid
 
 
 CYCLONEDX_VERSION = "1.6"
@@ -534,6 +535,7 @@ def main():
         "bomFormat": "CycloneDX",
         "$schema": f"http://cyclonedx.org/schema/bom-{CYCLONEDX_VERSION}.schema.json",
         "specVersion": f"{CYCLONEDX_VERSION}",
+        "serialNumber": uuid.uuid4().urn,
         "metadata": {
             "component": {
                 "bom-ref": args.project_name,
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Thomas Perale via buildroot]

Hi Heiko,

Thanks for the submission !

In reply of:
> In CycloneDX the serialNumber field is an optional top-level field that
> uniquely identified a SBOM using a URN RFC 4122 UUID format.
> 

Initially I didn't include this field for reproducibility concerns: generating
an SBOM from the same configuration wouldn't generate the same output.

Of course this is exactly the goal of this field from the spec point of view
but I was concerned this could be an issue for Buildroot. So I didn't include
this field and thought it could be set by the end user if needed like other
fields such as:

- version
- metadata
- ...

One of the idea I thought about to solve this would be for user to be able to
define a template the `generate-cyclonedx` would take as basis for the
generation.

```json
{
  "serialNumber": "{uuid.uuid4().urn}",
  "metadata": {
    "timestamp": "{datetime.now}"
    "authors": {
      "name": "..."
    }
  }
}
```

But i don't know if it feasible or nice to deal with from a user point of view.

Is there a tool you are using that enforce setting this field ?

Also in the commit message I would include the link to the spec:

https://cyclonedx.org/docs/1.6/json/#serialNumber

PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] utils/generate-cyclonedx: add uuid as serialNumber

[Heiko Thiery]

Hi Thomas,

Am Fr., 18. Sept. 2026 um 10:32 Uhr schrieb Thomas Perale
<thomas.perale@mind.be>:
>
> Hi Heiko,
>
> Thanks for the submission !
>
> In reply of:
> > In CycloneDX the serialNumber field is an optional top-level field that
> > uniquely identified a SBOM using a URN RFC 4122 UUID format.
> >
>
> Initially I didn't include this field for reproducibility concerns: generating
> an SBOM from the same configuration wouldn't generate the same output.
>
> Of course this is exactly the goal of this field from the spec point of view
> but I was concerned this could be an issue for Buildroot. So I didn't include
> this field and thought it could be set by the end user if needed like other
> fields such as:

Yes you are right, the spec says: "Every BOM generated SHOULD have a
unique serial number, even if the contents of the BOM have not changed
over time"

So I understand your concerns.

>
> - version
> - metadata
> - ...
>
> One of the idea I thought about to solve this would be for user to be able to
> define a template the `generate-cyclonedx` would take as basis for the
> generation.
>
> ```json
> {
>   "serialNumber": "{uuid.uuid4().urn}",
>   "metadata": {
>     "timestamp": "{datetime.now}"
>     "authors": {
>       "name": "..."
>     }
>   }
> }
> ```

Currently I use a post step to add the serialNumber field:

```
jq --arg sn "urn:uuid:$(cat /proc/sys/kernel/random/uuid)"
'{bomFormat, "$schema": .["$schema"], specVersion, serialNumber: $sn}
+ .' sbom.json
 ```
Having a template sounds also a good idea. With that you would be free
in adding all info in addition without modifying the script.

>
>
> But i don't know if it feasible or nice to deal with from a user point of view.
>
> Is there a tool you are using that enforce setting this field ?

There is no tool, but our company's security office requested this
field for their process.

>
> Also in the commit message I would include the link to the spec:
>
> https://cyclonedx.org/docs/1.6/json/#serialNumber

I can submit a v2 that adds this information.

> PERALE Thomas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot